I'm perhaps not looking at a purely Microsoft Solution here, but the cost of search / restores seem too unpredictable for budgetting purposes. Especially in big organizations where companies don't like "dead capital" just lying around, waiting to be used.
Are people here considering alternatives for long term archiving for compliancy and maybe threat hunting while keeping sentinel as their day-to-day SIEM for short term investigations and IOC's ?
